Malware

Question 1

What is malware?

Answer 1

Any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, deprive access to information, or which unknowingly interferes with the user’s computer security and privacy

Question 2

What are the phases of malware? (4)

Answer 2

1. Dormant
2. Spreading
3. Triggering
4. Attack

Question 3

What is the purpose of the dormant phase?

Answer 3

For the malware to remain undetected

Question 4

What is the purpose of the spreading phase?

Answer 4

To infect other hosts

Question 5

What is the purpose of the triggering phase?

Answer 5

Waiting for the commands or set of conditions to be satisfied in order to move from the dormant / spreading phase into the attack phase

Question 6

What is the purpose of the spreading phase?

Answer 6

Where the virus performs the malicious activity that is was designed to do, referred
to as the payload

Question 7

What is a method used to determine if a host is vulnerable?

Answer 7

Port scanning

Question 8

What is a backdoor?

Answer 8

a way to access a computer system that bypass the systems customary security
mechanisms

Question 9

How to defend against insider attacks? (5)

Answer 9

1. Avoid single points of failure - no one employee can
   be in charge of backups or manage critical systems
2. Use archiving tools and version control
3. Follow the principle of least privileges
4. Physically secure critical systems (e.g. air gaps, critical servers in locked rooms with power failure backup)
5. Control software installations to a reliable source

Question 10

What is a virus

Answer 10

a piece of malware that requires other programs in order to spread.

Question 11

what is a worm

Answer 11

a piece of malware that is able to spread independently

Question 12

what is a zero day vulnerability

Question 13

What is the limitation of static analysis for assessing software code for malware?

Answer 13

It only useful against known vulnerabilities and signatures

Question 14

how should dynamic analysis be done?

Answer 14

by running the new software in a sandbox and analyse the characteristics of the
software

Question 15

What is an asset?

Answer 15

anything that has value or can cause loss if compromised

Question 16

what is a threat?

Answer 16

Any potential for occurrence of a violation of security

Question 17

what is a vulnerability?

Answer 17

A weakness (gap/bug, etc) that can be exploited by an attacker to perform its attack

Question 18

what is a risk?

Question 19

what is a threat agent?

Answer 19

is an entity that poses a threat, i.e., can carry out an attack

Question 20

examples of vulnerabilities (6)

Answer 20

1. Buffer overflow
2. Weak crypto-suite
3. Flawed key management
4. Weak password policy
5. Hard-coded credentials
6. Weak input-validation